3 ms·

Is it possible that systems/packges hosted outside of google's ecosystem dont count in the scope of "Google vulnerability reward program". The author did go thr

Is it possible that systems/packges hosted outside of google's ecosystem dont count in the scope of "Google vulnerability reward program". The author did go through a lot of non-technical steps to demo the behavior he showed and It did seem like it involved social-engineering of sorts. so its understandable that they closed it as non-vulnerability.

burnished 4y ago
It completely lacked a social step?
- dataflow 4y ago
  It required tricking a trusted human to work. It's a human (social) vulnerability, not a software or hardware one. Human vulnerabilities can sometimes be mitigated with software or hardware (or other things), but that doesn't change the fact that they're based on human mistakes, not software or hardware mistakes.
  - denton-scratch 4y ago
    > It required tricking a trusted human to work. That's what I thought. Until I thought a bit more. Firstly he didn't fool the trusted human into doing anything they weren't already doing anyway. I don't see anyone being tricked. Secondly, a lot of exploits depend on someone doing, unprompted, something they really didn't ought to do. I mean, if you rule out as an exploit anthing that simply depends on people not taking active measures against an attack they didn't know about, there's not a lot left. I don't think Goo should have paid out, though; there's no vulnerability shown in any Google software, whether a product or an internal tool. It looks to me like a pip vuln that $TRUSTED_HUMAN could and should have evaded.
    - cozzyd 4y ago
      The vulnerability is the use of pip with internal tools
  - burnished 4y ago
    I'm having a hard time accepting a definition of social engineering that includes exploits where you do not in any way influence the behavior of others.
cachefault 4y ago
It's not clear from the article or Google's response what caused the dependency to be downloaded, however one thing that Google does mention is that they don't believe it has to do with their products or services. Since the purpose of their bug bounty program is to help Google secure their products, it would fall outside it's scope as the fix doesn't sit with product teams. I would imagine though this is something that would be raised with corporate security, that deals with protection of endpoint devices and security awareness training.

burnished 4y ago

It completely lacked a social step?

dataflow 4y ago
It required tricking a trusted human to work. It's a human (social) vulnerability, not a software or hardware one. Human vulnerabilities can sometimes be mitigated with software or hardware (or other things), but that doesn't change the fact that they're based on human mistakes, not software or hardware mistakes.
- denton-scratch 4y ago
  > It required tricking a trusted human to work. That's what I thought. Until I thought a bit more. Firstly he didn't fool the trusted human into doing anything they weren't already doing anyway. I don't see anyone being tricked. Secondly, a lot of exploits depend on someone doing, unprompted, something they really didn't ought to do. I mean, if you rule out as an exploit anthing that simply depends on people not taking active measures against an attack they didn't know about, there's not a lot left. I don't think Goo should have paid out, though; there's no vulnerability shown in any Google software, whether a product or an internal tool. It looks to me like a pip vuln that $TRUSTED_HUMAN could and should have evaded.
  - cozzyd 4y ago
    The vulnerability is the use of pip with internal tools
- burnished 4y ago
  I'm having a hard time accepting a definition of social engineering that includes exploits where you do not in any way influence the behavior of others.

cachefault 4y ago

It's not clear from the article or Google's response what caused the dependency to be downloaded, however one thing that Google does mention is that they don't believe it has to do with their products or services. Since the purpose of their bug bounty program is to help Google secure their products, it would fall outside it's scope as the fix doesn't sit with product teams. I would imagine though this is something that would be raised with corporate security, that deals with protection of endpoint devices and security awareness training.